Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1. CVSSv3.1 9.8 (CRITICAL)
Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X wishlist-member-x allows Object Injection.This issue affects WishList Member X: from n/a through <= 3.29.0. CVSSv3.1 8.8 (HIGH)
Deserialization of Untrusted Data vulnerability in Themeton Finag finag allows Object Injection.This issue affects Finag: from n/a through <= 1.5.0. CVSSv3.1 9.8 (CRITICAL)
Deserialization of Untrusted Data vulnerability in Themeton Zuut zuut allows Object Injection.This issue affects Zuut: from n/a through <= 1.4.2. CVSSv3.1 9.8 (CRITICAL)
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.7. CVSSv3.1 8.1 (HIGH)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through < 1.5.6. CVSSv3.1 8.1 (HIGH)
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1. CVSSv3.1 9.8 (CRITICAL) · EPSS 1th percentile
Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture woocommerce-wholesale-lead-capture allows Using Malicious Files.This issue affects Woocommerce Wholesale Lead Capture: from n/a through <= 2.0.3.1. CVSSv3.1 9.0 (CRITICAL) · EPSS 1th percentile
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Profile Builder Pro profile-builder-pro allows Blind SQL Injection.This issue affects Profile Builder Pro: from n/a through < 3.14.0. CVSSv3.1 9.3 (CRITICAL)
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme colorfolio allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through <= 1.3. CVSSv3.1 8.1 (HIGH)
Elastic Security Labs disclosed SILENTCONNECT, a multi-stage .NET loader actively deployed in-the-wild since March 2025 that silently installs ConnectWise ScreenConnect RMM via phishing campaigns. The infection chain leverages VBScript, PowerShell, PEB masquerading, UAC bypass via COM elevation, and Windows Defender exclusions to evade detection and establish persistent hands-on-keyboard access. Campaigns abuse Cloudflare Turnstile CAPTCHAs, Google Drive, and compromised legitimate websites as infrastructure to deliver the payload.
Sophos and Kaspersky identified Keenadu, a firmware-level backdoor pre-installed on Android devices from budget manufacturers (BLU, Ulefone, DOOGEE, etc.) affecting 500+ devices across 40 countries. The malware injects into libandroid_runtime.so via the Zygote process, achieving persistence across all apps and enabling second-stage payload delivery for ad fraud, credential theft, and data exfiltration. The compromise occurred at the firmware build phase, indicating a supply-chain attack at the OEM level.
Trend Micro researchers documented a targeted multi-stage PureLog Stealer campaign using localized copyright-violation lures to deliver information-stealing malware to healthcare, government, hospitality, and education sectors across Germany, Canada, the US, and Australia. The attack chain employs encrypted payloads, remote key retrieval, renamed WinRAR for extraction, Python-based loaders, and fileless .NET execution with AMSI bypass and anti-VM evasion. Two operational variants were identified, with the more recent chain using pre-bundled payloads and hardcoded decryption keys, while earlier variants relied on live C&C communication.
Elastic Security Labs disclosed SILENTCONNECT, a previously undocumented multi-stage loader actively deployed in-the-wild since March 2025 that delivers ConnectWise ScreenConnect RMM for hands-on keyboard access. The infection chain begins with phishing emails directing users to Cloudflare Turnstile CAPTCHA pages, followed by VBScript execution that downloads and compiles C# code in-memory via PowerShell, ultimately installing ScreenConnect via MSI. The loader employs PEB masquerading, UAC bypass via COM elevation, Windows Defender exclusion, and NT API calls to evade detection while leveraging trusted infrastructure (Google Drive, Cloudflare) for payload hosting.
A vulnerability in MLflow's pyfunc extraction process allows for arbitrary file writes due to improper handling of tar archive entries. Specifically, the use of `tarfile.extractall` without path validation enables crafted tar.gz files containing `..` or absolute paths to escape the intended extraction directory. This issue affects the latest version of MLflow and poses a high/critical risk in scenarios involving multi-tenant environments or ingestion of untrusted artifacts, a CVSSv3.1 9.1 (CRITICAL)
OmniGen2-RL contains an unauthenticated remote code execution vulnerability in the reward server component that allows remote attackers to execute arbitrary commands by sending malicious HTTP POST requests. Attackers can exploit insecure pickle deserialization of request bodies to achieve code execution on the host system running the exposed service. CVSSv3.1 9.8 (CRITICAL) · EPSS 61th percentile
Mythic v3.4.0.48 released with a Dockerfile tag bump to match the release version. This is a routine version bump with no disclosed security fixes, features, or breaking changes in the available metadata.
Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size. CVSSv3.1 8.2 (HIGH)
Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write files to arbitrary locations on the filesystem, restricted only by file system access permissions of the user running Jenkins. This can be exploited to deploy malicious scripts or plugins on the controller by attackers with Item/Configure permission, or able to control agent processes. CVSSv3.1 8.8 (HIGH)
When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation. CVSSv3.1 8.2 (HIGH) · EPSS 2th percentile
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1. CVSSv3.1 9.8 (CRITICAL)
SpecterOps announced BloodHound Enterprise with OpenGraph extensions for GitHub, enabling attack path analysis across GitHub identities, repositories, CI/CD workflows, secrets, and external trust relationships (SSO, OIDC federation to Azure/AWS). The extension models how GitHub acts as both a target and an interchange between systems, exposing paths to critical code, credentials, and cloud pivots that traditional configuration review misses.
SpecterOps announced BloodHound Enterprise 9.0 with OpenGraph extensions enabling attack path mapping across Okta, GitHub, and Jamf-managed macOS environments, moving beyond Microsoft-only visibility. The platform now identifies cross-platform privilege chains and introduces Privilege Zones for defining critical security boundaries. The expansion addresses the reality that modern breaches chain privileges across identity providers, developer platforms, and device management systems.
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: bounds-check link_id in ieee80211_ml_reconfiguration link_id is taken from the ML Reconfiguration element (control & 0x000f), so it can be 0..15. link_removal_timeout[] has IEEE80211_MLD_MAX_NUM_LINKS (15) elements, so index 15 is out-of-bounds. Skip subelements with link_id >= IEEE80211_MLD_MAX_NUM_LINKS to avoid a stack out-of-bounds write. CVSSv3.1 8.8 (HIGH) · EPSS 6th percentile
Kaspersky's MDR team dissected an active Horabot campaign targeting 5,384 victims (93% in Mexico) combining fake CAPTCHA lures, polymorphic HTA/VBS loaders, AutoIT-wrapped banking Trojans (Casbaneiro/Ponteiro variants), and email spreader functionality. The attack chain leverages server-side polymorphism, custom XOR-subtraction ciphers for C2 communication, and anti-VM checks, with detailed analysis of encryption routines, socket protocols, and configuration parsing mechanisms.